ClawHub
Back to skill

Security audit

Gitignore Gen

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward .gitignore generator whose GitHub network use, local file writes, and small cache match its stated purpose.

Reasonable to install for normal use. It contacts GitHub to retrieve templates and can overwrite or append to files when requested, so preview with --stdout or avoid --force when working in important repositories.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation advertises capabilities to read files, write files, inspect project directories, and fetch GitHub-based templates, but no explicit permissions are declared. That mismatch can cause the agent to perform filesystem and network actions without clear user-visible authorization boundaries, increasing the risk of unintended file modification or external data access. In this context the behavior is expected for the feature set, but the lack of declared permissions is still a real security weakness rather than an exploit by itself.

Static analysis

No suspicious patterns detected.